TRG vger.timpanogas.org hacked
Our master server (vger.timpanogas.org) running 2.2.19 was hacked and completely obliterated by someone using a Novell Proxy Cache via a kernel level exploit in [sys_wait+4]. They somehow created a segmentation fault down inside the kernel, then gained access to the /lib directory and relinked the libraries to a set of bogus libs, which gave them access to the server. Only public code and email is processed on this server.
For those interested in reviewing this attack, I have the entire previous hard disk available and can mount it under the public ftp area if anyone is curious as to how these folks did this. They exploited BIND 8.2.3 to get in and logs indicated that someone was using a "back door" in Novell's NetWare proxy caches to perform the attack (since several different servers were used as "blinds" to get in).
We are unable to determine just how they got in exactly, but they kept trying and created an oops in the affected code which allowed the attack to proceed.
Jeff
Quoted 2 lines
is curious as to how these folks did this. They exploited BIND 8.2.3 to get in and logs indicated that someone was using a "back door" in
Bind runs as root.
Quoted 3 lines
We are unable to determine just how they got in exactly, but they kept trying and created an oops in the affected code which allowed the attack to proceed.
Are you sure they didnt in fact simply screw up live patching the kernel to cover their traces
Quoted 4 lines · Alan Cox
Quoted 2 lines
is curious as to how these folks did this. They exploited BIND 8.2.3 to get in and logs indicated that someone was using a "back door" in
Bind runs as root.
Not if set up properly. And there is no known hole in BIND 8.2.3-REL so I'm wondering how Jeff found out that the intruder got in via BIND.
Quoted 1 line · Jeff V. Merkey
is curious as to how these folks did this. They exploited BIND 8.2.3
Look below.
Quoted 3 lines
to get in and logs indicated that someone was using a "back door" in Novell's NetWare proxy caches to perform the attack (since several different servers were used as "blinds" to get in).
There is AFAIK no known exploit to BIND 8.2.3 and I don't see why anyone should use a "novell Netcache backdoor". If I'd want to hack your box, I would use this:
% telnet vger.timpanogas.com 22
Trying 207.109.151.240...
Connected to vger.timpanogas.com.
Escape character is '^]'.
SSH-1.5-1.2.27
^]
telnet> quit
Well known exploits downloadable at any of the better hacking sites.
Quoted 3 lines
We are unable to determine just how they got in exactly, but they kept trying and created an oops in the affected code which allowed the attack to proceed.
Come on, you can't be _that_ blind. Either you didn't install all your vendor recommended updates or you installed self rolled programs and got caught.
You even get connects on the telnet port (no daemon, though), so you either have a hosts.allow (which _is_ spoofable) or a non-cleaned up [x]inetd.conf which means you didn't harden your box for Internet usage.
If you don't prepare your box for a hostile environment, you get hit. First law of the Internet.
Regards
Henning
Signature · 5 lines
Dipl.-Inf. (Univ.) Henning P. Schmiedehausen -- Geschaeftsfuehrer INTERMETA - Gesellschaft fuer Mehrwertdienste mbH [email protected] Am Schwabachgrund 22 Fon.: 09131 / 50654-0 [email protected] D-91054 Buckenhof Fax.: 09131 / 50654-20
Quoted 5 lines · Henning P. Schmiedehausen
Connected to vger.timpanogas.com.
Escape character is '^]'.
SSH-1.5-1.2.27Well known exploits downloadable at any of the better hacking sites.
This _may_ be misleading. I had several boxes where I patched ssh 1.2.27 as a short-term solution.
Anyway, we're getting OT :-)
Regards,
Daniel
Quoted 4 lines · Alan Cox
Quoted 2 lines
is curious as to how these folks did this. They exploited BIND 8.2.3 to get in and logs indicated that someone was using a "back door" in
Bind runs as root.
It doesn't have to. In fact, I just set up a RedHat 6.2 Honeypot
a couple of weeks ago researching Bind based worms that are becoming a problem. Much to my surprise, that OOB RedHat 6.2 system ran bind as "named -u named" and was running Bind under a common user id. RedHat 6.0 runs it as root and I haven't checked 6.1 yet. Don't know about the other distros, yet.
Quoted 6 lines
Quoted 3 lines
We are unable to determine just how they got in exactly, but they kept trying and created an oops in the affected code which allowed the attack to proceed.
Are you sure they didnt in fact simply screw up live patching the kernel to cover their traces
That would be a hint that they MIGHT have been trying to get a
Linux kernel stealth module going. Several of the worms I'm looking at include the Adore LKM to hide processes, files, and sockets. That worm (as several others like it) also upgrade the version of Bind they broke in through to prevent further compromise. There will be a security advisory out on these worms, probably later this week.
Mike
Signature · 4 lines
Michael H. Warfield | (770) 985-6132 | [email protected] (The Mad Wizard) | (678) 463-0932 | http://www.wittsend.com/mhw/ NIC whois: MHW9 | An optimist believes we live in the best of all PGP Key: 0xDF1DD471 | possible worlds. A pessimist is sure of it!
Quoted 11 lines · Alan Cox
Quoted 2 lines
is curious as to how these folks did this. They exploited BIND 8.2.3 to get in and logs indicated that someone was using a "back door" in
Bind runs as root.
Quoted 3 lines
We are unable to determine just how they got in exactly, but they kept trying and created an oops in the affected code which allowed the attack to proceed.
Are you sure they didnt in fact simply screw up live patching the kernel to cover their traces
Could have. The kernel is unable to dismount the root volume when booted. I can go through the drive and remove confidential stuffd and just leave the system intact and post the entire system image to my ftp server.
I have changed all the passwords on the server, so what's there is no big deal. This server was public FTP and web/email, so nothing really super "confidential" on it.
Jeff
Quoted 10 lines · Jeff V. Merkey
Quoted 8 lines · Alan Cox
Quoted 2 lines
is curious as to how these folks did this. They exploited BIND 8.2.3 to get in and logs indicated that someone was using a "back door" in
Bind runs as root.
Quoted 3 lines
We are unable to determine just how they got in exactly, but they kept trying and created an oops in the affected code which allowed the attack to proceed.
Quoted 6 lines
Quoted 2 lines
Are you sure they didnt in fact simply screw up live patching the kernel to cover their traces
Could have. The kernel is unable to dismount the root volume when booted. I can go through the drive and remove confidential stuffd and just leave the system intact and post the entire system image to my ftp server.
This would be a good thing for those of us involved in investigating
these sorts of things. :-/
Quoted 5 lines
I have changed all the passwords on the server, so what's there is no big deal. This server was public FTP and web/email, so nothing really super "confidential" on it.
Jeff
Mike
Signature · 4 lines
Michael H. Warfield | (770) 985-6132 | [email protected] (The Mad Wizard) | (678) 463-0932 | http://www.wittsend.com/mhw/ NIC whois: MHW9 | An optimist believes we live in the best of all PGP Key: 0xDF1DD471 | possible worlds. A pessimist is sure of it!